Abstract:

As the existing malicious code detection methods based on deep learning have problems of insufficiency and low accuracy of feature extraction， a malicious code detection method based on attention mechanism and Residual Network （ResNet） called ARMD was proposed. To support the training of this method， the hash values of 47 580 malicious and benign codes were obtained from Kaggle website， and the APIs called by each code were extracted by analysis tool VirusTotal. After that， the called APIs were integrated into 1 000 non-repeated APIs as the detection features， and the training sample data was constructed through these features. Then， the sample data was labeled by determining the benignity and maliciousness based on the VirusTotal analysis results， and the SMOTE （Synthetic Minority Over-sampling Technique） enhancement algorithm was used to equalize the data samples. Finally， the ResNet injecting with the attention mechanism was built and trained to complete the malicious code detection. Experimental results show that the accuracy of malicious code detection of ARMD is 97.76%， and compared with the existing detection methods based on Convolutional Neural Network （CNN） and ResNet models， ARMD has the average precision improved by at least 2%， verifying the effectiveness of ARMD.

Key words: deep learning, malicious code, attention mechanism, Residual Network (ResNet), SMOTE (Synthetic Minority Over-sampling Technique)

摘要：

针对目前已有的基于深度学习的恶意代码检测方法提取特征不足和准确率低的问题，提出一种基于注意力机制和残差网络（ResNet）的恶意代码检测方法ARMD。为了支持该方法的训练，从Kaggle网站获取了47 580个恶意和良性代码的Hash值，并利用VirusTotal分析工具提取每个代码数据调用的API，在此之后将所调用的API整合为1 000个不重复的API作为检测的特征来构造训练样本数据；然后根据VirusTotal的分析结果进行良恶性判定进而标记样本数据，并采用SMOTE增强算法使数据样本均衡化；最后构建并训练注入注意力机制的ResNet，从而实现恶意代码检测。实验结果表明ARMD的恶意代码检测准确率为97.76%，且与目前已有的基于卷积神经网络（CNN）和ResNet模型的检测方法相比，平均精确率至少提高了2个百分点，验证了ARMD的有效性。

关键词: 深度学习, 恶意代码, 注意力机制, 残差网络, SMOTE